The issue with HPKP is that revocation is not possible if you don’t control the key that was pinned for your users. E.g. if an admin accidentally wipes the keys

The issue with HPKP is that revocation is not possible if you don’t control the key that was pinned for your users. E.g. if an admin accidentally wipes the keystore, there’s no way of revoking the pinning info from the users’ browser. Taking this one step further, if an adversary enables HPKP on your behalf with a key that you don’t control, you’ll be at his mercy to keep your site operational.